1304 matches found
zoneminder-rce-poc
just wait and see Proof of concept for an OS command injection vulnerability in ZoneMinder's event export functionality web/includes/downloadfunctions.php. Monitor names are interpolated directly into shell commands using manual single-quote wrapping instead of escapeshellarg. An attacker who can...
CVE-2026-76060_ZoneMinder_CommandInjection-PoC
just wait and see Proof of concept for an OS command injection vulnerability in ZoneMinder's event export functionality web/includes/downloadfunctions.php. Monitor names are interpolated directly into shell commands using manual single-quote wrapping instead of escapeshellarg. An attacker who can...
Linux Distros Unpatched Vulnerability : CVE-2026-76060
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitiz...
CVE-2023-26035
POC for CVE-2023-26035 Works for ZoneMinder Versions prior to 1.36.33 and 1.37.33 Vulnerability : Remote Code Execution RCE Usage root@kitploit: └─➜ python3 poc.py -h usage: poc.py -h --target TARGET --cmd CMD poc.py: error: the following arguments are required: --target, --cmd Curl Before jumpin...
CVE-2016-10204_Webshell
CVE-2016-10204Webshell Un script de bash que demuestra la explotación manual de CVE-2016-10204 contra un endpoint objetivo, que lleva a la subida de una webshell php. Actualmente, la variable webshell está configurada para un payload de MySQL. Esto se puede reemplazar con cualquier backend que...
CVE-2026-27470
⚠️ YASAL UYARI / LEGAL DISCLAIMER Bu araç yalnızca eğitim amaçlı ve yazılı izin alınmış güvenlik testleri için geliştirilmiştir. Sahip olmadığınız veya test etmek için açık yazılı izniniz olmayan sistemlere karşı kullanılması yasadışıdır. Yetkisiz erişim, birçok ülkede ağır cezai yaptırımlara...
CVE-2026-27470-POC
CVE-2026-27470 — ZoneMinder Second-Order SQL Injection PoC Author:d3vn0mi | CVSS 8.8 | Authenticated | Events Permission Required Overview CVE-2026-27470 is a second-order SQL injection vulnerability in ZoneMinder's web/ajax/status.php — specifically the getNearEvents function...
sqli-hunter-CVE-2024-51482-PoC
sqli-hunter-CVE-2024-51482-PoC Python scripts for exploiting CVE-2024-51482 SQLi in ZoneMinder — HTB CCTV sqli-hunter — CVE-2024-51482 Description This script automates the extraction of databases, tables, columns, and credentials by exploiting CVE-2024-51482, a Boolean-based SQL Injection...
CVE-2026-76060
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...
CVE-2026-76060
An authenticated OS command injection vulnerability in ZoneMinder's event export functionality allows any user with View Events permission to execute arbitrary commands on the server. The exportFile HTTP parameter is passed unsanitized into a shell command executed via PHP's exec() , enabling ful...
CVE-2026-76060 OS Command Injection in PayRange API
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...
CVE-2026-76060 OS Command Injection in PayRange API
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...
PT-2026-82281
Name of the Vulnerable Software and Affected Versions ZoneMinder affected versions not specified Description An authenticated OS command injection issue exists in the event export functionality. An authenticated user with View Events permission can execute arbitrary operating system commands on t...
Zoneminder
ADVISORY SUMMARY Successful exploitation of this vulnerability could result in full Remote Code Execution RCE as the web server user. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for...
Linux Distros Unpatched Vulnerability : CVE-2026-72556
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the...
DEBIAN-CVE-2026-72556
A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit and canDelete methods invoke nonexistent methods on the ZM\User class, causing PHP call to return a truthy valu...
CVE-2026-72556
A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit and canDelete methods invoke nonexistent methods on the ZM\User class, causing PHP call to return a truthy valu...
UBUNTU-CVE-2026-72556
A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit and canDelete methods invoke nonexistent methods on the ZM\User class, causing PHP call to return a truthy valu...
CVE-2026-72556 ZoneMinder ZoneMinder - Remote Code Execution
A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit and canDelete methods invoke nonexistent methods on the ZM\User class, causing PHP call to return a truthy valu...
EUVD-2026-56026
A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit and canDelete methods invoke nonexistent methods on the ZM\User class, causing PHP call to return a truthy valu...